add rule

mandiant · Aug 27, 2023 · 7c2ac2d · 7c2ac2d
1 parent e1c0ac2
commit 7c2ac2d
Showing 1 changed file with 24 additions and 0 deletions.
diff --git a/nursery/send-sms-on-android.yml b/nursery/send-sms-on-android.yml
@@ -0,0 +1,24 @@
+rule:
+  meta:
+    name: send SMS on Android
+    namespace: communication/sms
+    authors:
+      - "@mr-tz"
+    scope: function
+    # att&ck:
+    #   - Mobile::SMS Control [T1582]
+  features:
+    - and:
+      - os: android
+      # ... = (*env)->FindClass(env, "android/telephony/SmsManager");
+      - string: "android/telephony/SmsManager"
+      - optional:
+        - or:
+          - and:
+            - arch: i386
+            - offset: 0x30 = (*env)->FindClass
+          - and:
+            - arch: amd64
+            - offset: 0x1C = (*env)->FindClass
+      # ... = (*env)->GetMethodID(env, ..., "sendTextMessage" ...);
+      - string: "sendTextMessage"